CVE-2026-97605

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the erofs component regarding the preservation of LZMA decoders during a pool-resize failure. The pool-resize path frees an old decoder before allocating a replacement; if allocation fails for a stream, that stream is returned to the list with a NULL state. However, the z erofs lzma max dictsize variable is advanced as if the resize were successful. This allows an existing LZMA mount to select the broken stream and pass NULL to the xz dec microlzma reset() function. Subsequent retries at the same size skip the resize attempt because the global maximum was already advanced, leaving the invalid state unrepaired.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.